fix: CI deploy parity with compose — media env, volume, healthcheck

A missing env var aborts supervisord's %(ENV_x)s config expansion and
takes every program down, which is why the media-player merge failed
CI (run 151): rebuild.yml's docker run did not pass MEDIA_DIR /
MEDIA_SERVER_PORT / YTDLP_COOKIES.

- supervisord.conf: media-server inherits those vars from the container
  environment instead of hard-requiring them (media_server.py has safe
  defaults for all three).
- rebuild.yml: mount the media library volume, pass the media env, and
  extend the healthcheck to the media server healthz.
- compose: YTDLP_COOKIES defaults to the conventional /data/media/
  cookies.txt path (ignored unless the file exists).

Parity verified: container started with CI's exact env (no media vars)
— all five programs RUNNING.

.gitea/workflows/rebuild.yml

@@ -26,7 +26,7 @@ jobs:
             --name voice \
             --network host \
             --restart unless-stopped \
-            --health-cmd='curl -sk https://localhost:${WEB_PORT:-9178}/ -o /dev/null && curl -s http://localhost:7880/ -o /dev/null' \
+            --health-cmd='curl -sk https://localhost:${WEB_PORT:-9178}/ -o /dev/null && curl -s http://localhost:7880/ -o /dev/null && curl -s http://localhost:${MEDIA_SERVER_PORT:-8092}/media/api/healthz -o /dev/null' \
             --health-interval=15s \
             --health-timeout=5s \
             --health-retries=3 \
@@ -34,6 +34,7 @@ jobs:
             -v /mnt/user/dev/hope-voice-api/certs:/etc/voice/certs \
             -v /mnt/user/dev/hope-voice-api/skills:/skills \
             -v /mnt/user/dev/hope-voice-api/livekit.yaml:/etc/livekit.yaml:ro \
+            -v /mnt/user/dev/hope-voice-api/media:/data/media \
             -e LIVEKIT_URL=http://localhost:7880 \
             -e LIVEKIT_API_KEY=devkey \
             -e LIVEKIT_API_SECRET=hopevoice-devsecret-2026-lan-only \
@@ -48,6 +49,9 @@ jobs:
             -e WEB_PORT=9178 \
             -e VOICE_USERS_FILE=/etc/hope/users.json \
             -e VOICE_DEFAULT_USER=shane \
+            -e MEDIA_DIR=/data/media \
+            -e MEDIA_SERVER_PORT=8092 \
+            -e YTDLP_COOKIES=/data/media/cookies.txt \
             hope-voice-api-voice:latest
 
       - name: Verify deployment

docker-compose.yml

@@ -20,7 +20,7 @@ services:
       VOICE_DEFAULT_USER: "${VOICE_DEFAULT_USER:-shane}"
       MEDIA_DIR: "/data/media"
       MEDIA_SERVER_PORT: "${MEDIA_SERVER_PORT:-8092}"
-      YTDLP_COOKIES: "${YTDLP_COOKIES:-}"
+      YTDLP_COOKIES: "${YTDLP_COOKIES:-/data/media/cookies.txt}"
     volumes:
       - ./livekit.yaml:/etc/livekit.yaml:ro
       - ./certs:/etc/voice/certs

supervisord.conf

@@ -60,6 +60,10 @@ environment=
 [program:media-server]
 ; Runs as root because the /data/media bind mount is a host (Unraid) share
 ; whose uid does not match the container's voiceuser.
+; MEDIA_DIR / MEDIA_SERVER_PORT / YTDLP_COOKIES are inherited from the
+; container environment (media_server.py has safe defaults for all three) —
+; do NOT list them via %(ENV_x)s here: a missing var aborts supervisord's
+; config expansion and takes every program down with it.
 command=/opt/voice-agent/.venv/bin/python /opt/voice/media_server.py
 user=root
 autostart=true
@@ -67,7 +71,3 @@ autorestart=true
 stdout_logfile=/dev/stdout
 stdout_logfile_maxbytes=0
 redirect_stderr=true
-environment=
-    MEDIA_DIR="%(ENV_MEDIA_DIR)s",
-    MEDIA_SERVER_PORT="%(ENV_MEDIA_SERVER_PORT)s",
-    YTDLP_COOKIES="%(ENV_YTDLP_COOKIES)s"